Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
3eb04652a3a57731b166a03425639ddd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3eb04652a3a57731b166a03425639ddd.exe
Resource
win10v2004-20231215-en
General
-
Target
3eb04652a3a57731b166a03425639ddd.exe
-
Size
512KB
-
MD5
3eb04652a3a57731b166a03425639ddd
-
SHA1
0dab4b6bdd78b3495bab0ed32ca24d9d4d25d23f
-
SHA256
cfb4d6ee578e544d7eebf0d054801c482878b0aa1bf6187ed236db3b8da6a8ca
-
SHA512
215b4b65d4a40eb000f42d5c218c34b5b2205d6bd513989dbf37d418f4feb88844b7f3641eaa9fe46f6810516dab8bd4febe757e241c309bb8bff6e45382280b
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6l:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1528 qogderbqaa.exe 1504 wlluocbnfdbufqf.exe 1716 qbvkrxsl.exe 2268 qbfjejybgdqnt.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3792-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\qbvkrxsl.exe 3eb04652a3a57731b166a03425639ddd.exe File opened for modification C:\Windows\SysWOW64\qbvkrxsl.exe 3eb04652a3a57731b166a03425639ddd.exe File created C:\Windows\SysWOW64\qbfjejybgdqnt.exe 3eb04652a3a57731b166a03425639ddd.exe File opened for modification C:\Windows\SysWOW64\qbfjejybgdqnt.exe 3eb04652a3a57731b166a03425639ddd.exe File created C:\Windows\SysWOW64\qogderbqaa.exe 3eb04652a3a57731b166a03425639ddd.exe File opened for modification C:\Windows\SysWOW64\qogderbqaa.exe 3eb04652a3a57731b166a03425639ddd.exe File created C:\Windows\SysWOW64\wlluocbnfdbufqf.exe 3eb04652a3a57731b166a03425639ddd.exe File opened for modification C:\Windows\SysWOW64\wlluocbnfdbufqf.exe 3eb04652a3a57731b166a03425639ddd.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 3eb04652a3a57731b166a03425639ddd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F76BB9FF6621DED273D1A48A08916B" 3eb04652a3a57731b166a03425639ddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C70C15E0DAB4B8C17FE7ECE234CC" 3eb04652a3a57731b166a03425639ddd.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 3eb04652a3a57731b166a03425639ddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32422C779C5583206A4277D270242DDF7D8F64D8" 3eb04652a3a57731b166a03425639ddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9FAB8F961F2E5837F3B42869939E6B08902F04311023CE1C8459A08D3" 3eb04652a3a57731b166a03425639ddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB128449339E952CCB9A133EFD7CA" 3eb04652a3a57731b166a03425639ddd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FFFC4826851B913DD72D7E9CBDEFE135594366466330D690" 3eb04652a3a57731b166a03425639ddd.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 1504 wlluocbnfdbufqf.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 3792 3eb04652a3a57731b166a03425639ddd.exe 1504 wlluocbnfdbufqf.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3792 wrote to memory of 1528 3792 3eb04652a3a57731b166a03425639ddd.exe 29 PID 3792 wrote to memory of 1528 3792 3eb04652a3a57731b166a03425639ddd.exe 29 PID 3792 wrote to memory of 1528 3792 3eb04652a3a57731b166a03425639ddd.exe 29 PID 3792 wrote to memory of 1504 3792 3eb04652a3a57731b166a03425639ddd.exe 28 PID 3792 wrote to memory of 1504 3792 3eb04652a3a57731b166a03425639ddd.exe 28 PID 3792 wrote to memory of 1504 3792 3eb04652a3a57731b166a03425639ddd.exe 28 PID 3792 wrote to memory of 1716 3792 3eb04652a3a57731b166a03425639ddd.exe 27 PID 3792 wrote to memory of 1716 3792 3eb04652a3a57731b166a03425639ddd.exe 27 PID 3792 wrote to memory of 1716 3792 3eb04652a3a57731b166a03425639ddd.exe 27 PID 3792 wrote to memory of 2268 3792 3eb04652a3a57731b166a03425639ddd.exe 26 PID 3792 wrote to memory of 2268 3792 3eb04652a3a57731b166a03425639ddd.exe 26 PID 3792 wrote to memory of 2268 3792 3eb04652a3a57731b166a03425639ddd.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\3eb04652a3a57731b166a03425639ddd.exe"C:\Users\Admin\AppData\Local\Temp\3eb04652a3a57731b166a03425639ddd.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵PID:5112
-
-
C:\Windows\SysWOW64\qbfjejybgdqnt.exeqbfjejybgdqnt.exe2⤵
- Executes dropped EXE
PID:2268
-
-
C:\Windows\SysWOW64\qbvkrxsl.exeqbvkrxsl.exe2⤵
- Executes dropped EXE
PID:1716
-
-
C:\Windows\SysWOW64\wlluocbnfdbufqf.exewlluocbnfdbufqf.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1504
-
-
C:\Windows\SysWOW64\qogderbqaa.exeqogderbqaa.exe2⤵
- Executes dropped EXE
PID:1528
-
-
C:\Windows\SysWOW64\qbvkrxsl.exeC:\Windows\system32\qbvkrxsl.exe1⤵PID:3136